CVE-2026-128040

high

Description

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.

References

https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-stored-xss-via-admin-dataflow-tax-oauth-paypal-fields

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m858-x59w-rmp5

https://github.com/OpenMage/magento-lts/commit/e97e257b8f8d74d2e52dbf28caa211c262ff26be

https://github.com/OpenMage/magento-lts/commit/d10314ddda9a6081bc27370b463b5f77c2e499de

https://github.com/OpenMage/magento-lts/commit/7f7a9deaac11fd2437bb1f8065db152a4b620609

https://github.com/OpenMage/magento-lts/commit/62d2885fa6e7a4454e3a5c7765a6a5ca0085ecc1

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125068

Details

Source: Mitre, NVD

Published: 2026-11-13

Updated: 2026-11-13

Risk Information

CVSS v2

Base Score: 7.7

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Severity: Medium

CVSS v4

Base Score: 8.4

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00313